Skip to main content

Symantec Responds To Google Distrusting Its Certificates

Google announced in March that its Chrome browser would gradually stop trusting certificates issued by Symantec because the company improperly issued 30,000 certificates over the last few years. Symantec responded today with a blog post saying it's met with Google to discuss the issue several times and that its customers have said the change would "cause significant business disruption and additional expense."

Certificates are used to verify a website operator's identity. If everything's on the up-and-up, browsers can then form secure connections with the site, which allows you to send or access sensitive data without having to worry about it being compromised. This means it's important for certificates to be properly issued; otherwise an ostensibly secure connection might actually put your private information at risk.

Google discovered in 2015 that Symantec issued certificates for its Google.com domain even though it never requested those certificates. This led both companies to investigate Symantec's certificate issuing process, and eventually they discovered several mis-issued certificates. Google said roughly 30,000 certificates were improperly issued; Symantec said in a message to its customers that only 127 certificates weren't properly issued.

Symantec also said that the mis-issued certificates "resulted in no consumer harm" and that it believed Google's statements were "exaggerated and misleading." The company added that it would "vigorously defend the safe and productive use of the internet, including minimizing any potential disruption caused by the proposal in Google’s blog post," and that it was "open to discussing the matter with Google" in the future.

Now the company has issued another message to its customers about Chrome not trusting its certificates. Symantec said it's met with Google several times to work towards a solution that won't result in problems for its customers or consumers. Here's the crux of the post:

We have also heard consistently from customers like you that the transition to fully adopt Google's proposal within its suggested timeframe would cause significant business disruption and additional expense - especially within complex IT infrastructures. Mitigating these concerns is a top priority for us as we develop our counter proposal and provide responses to the salient questions the community has posted online. While we believe Google understands the burden their proposal creates, if they decide to move ahead with their original plan, I want to reassure you that Symantec will keep your websites, web servers or web applications operational across all browsers. Specifically, this may require Symantec to reissue your certificates, which we would do as needed, at no charge to you, to meet the fully expected validity period.

This isn't an easy problem to solve. Google acknowledged in March that Chrome distrusting Symantec-issued certificates would likely result in consumers blaming the browser for their problems, and as Symantec made clear today, its customers would have to scramble to meet Google's requirements. A failure on either company's part could endanger consumer privacy or make it hard for website operators to serve their customers.

Symantec asked its customers to fill out an anonymous survey about the issue. It has just four questions:

  • How important are Symantec's Extended Validation certificates to you
  • What are the barriers to adopting shorter validity certificates
  • On what timeframe could you successfully adopt shorter validity certificates
  • What impact would Google's proposal have on your business?

That seems (unsurprisingly) one-sided.

Affected businesses have a while to respond. Chrome will slowly require shorter validity certificates over time--Chrome 59 will trust certificates for 33 months, for example, whereas Chrome 64 will trust them for only nine months. Chrome 64 isn't expected to reach the average consumer until early 2018, however, which leaves businesses almost a year to implement the shorter validity certificates to avoid downtime for their websites.

  • derekullo
    I'm guessing the meeting between Symantec and Google went something like this:

    Symantec: Oh No You Didn't.

    Google: Oh Yes We Did.
    Reply
  • brucek2
    Or couldn't all those customers easily purchase a certificate from a more reputable vendor?
    Reply
  • Lkaos
    Google should just kill the said certificates and make they ask for the certification again...Dont take Symantec trying to force the certificates acceptance. It was Symantec's fault!
    Reply
  • problematiq
    This sounds a lot like our conversations to vendors, "Us: you screwed up and almost compromised the entire system, we are switching to someone else. Them: Ohhh.. it wasn't THAT bad, you were not compromised.. probably.. Plus we are pretty sure it's all your fault. Us: Riiighht... bye bye."
    Reply
  • ingtar33
    I'm actually disappointed that google or ANY web browser accepts Symantec certs when there are wrongly issues certs out there. Doesn't this invalidate the whole HTTPS security standard?
    Reply
  • kenjitamura
    Symantec is quickly becoming synonymous with "grossly negligent" and "highly insecure". Google also skewered them over their antivirus software last year:

    "Symantec dropped the ball here. A quick look at the decomposer library shipped by Symantec showed that they were using code derived from open source libraries ... but hadn't updated them in at least 7 years"
    Reply
  • ammaross
    At least Google is being reasonable with their mitigation option. Incrementally shorter trust periods is a good thing. Let's Encrypt has been working in that direction since inception, and it's free.
    https://letsencrypt.org/
    Reply
  • turkey3_scratch
    There is an easy solution. If Google Chrome says the certificate is invalid, all they have to do is "add an exception" and then they can access the site. It will still use https and be encrypted. The only purpose of an SSL certificate is to basically say "this site is legitimate" but in a work/business environment I would think people would know where they are going and if it's safe (hopefully). Additionally, having a certificate doesn't necessarily even mean the site is safe. Your data can still be compromised. I have acquired a certificate (I think it was from Comodo) for my website before, and I have to say they have absolutely no idea what I can do with my website even though I have said certificate saying it is safe.

    SSL certificates have always been somewhat of a money grab IMO. It doesn't actually change the connection or encryption. It's more of a business gimmick of "give us money and we'll give you a certificate saying your site is safe and friendly". It gets even more crazy, if you want your website to have that "green lock" in the URL address bar of your web browser, you have to pay a ton of money to the certificate company, I'm talking like over $100,000 from what I recall. Big corporations like microsoft.com will have this.


    TLDR certificates are a money grab that don't really changer the connection at all. They're supposed to mean a site is legit and safe but undoubtedly an unsafe site can surely get a certificate. Idealistically the certificate companies should be looking at the sites that have their certificates to ensure the safety, but I don't think that happens.
    Reply
  • hoofhearted
    If a jack the hack redirects DNS to point to a copy of said website, he would have to steal the private key to get out of making bob the knob having to add an exception.
    Reply
  • problematiq
    19579274 said:
    There is an easy solution. If Google Chrome says the certificate is invalid, all they have to do is "add an exception" and then they can access the site. It will still use https and be encrypted. The only purpose of an SSL certificate is to basically say "this site is legitimate" but in a work/business environment I would think people would know where they are going and if it's safe (hopefully). Additionally, having a certificate doesn't necessarily even mean the site is safe. Your data can still be compromised. I have acquired a certificate (I think it was from Comodo) for my website before, and I have to say they have absolutely no idea what I can do with my website even though I have said certificate saying it is safe.

    SSL certificates have always been somewhat of a money grab IMO. It doesn't actually change the connection or encryption. It's more of a business gimmick of "give us money and we'll give you a certificate saying your site is safe and friendly". It gets even more crazy, if you want your website to have that "green lock" in the URL address bar of your web browser, you have to pay a ton of money to the certificate company, I'm talking like over $100,000 from what I recall. Big corporations like microsoft.com will have this.


    TLDR certificates are a money grab that don't really changer the connection at all. They're supposed to mean a site is legit and safe but undoubtedly an unsafe site can surely get a certificate. Idealistically the certificate companies should be looking at the sites that have their certificates to ensure the safety, but I don't think that happens.

    That is not how it works brochacho.
    Reply